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Summary 


Damage  to  or  destruction  of  the  nation’s  water  supply  and  water  quality 
infrastructure  by  terrorist  attack  could  disrupt  the  delivery  of  vital  human  services  in  this 
country,  threatening  public  health  and  the  environment,  or  possibly  causing  loss  of  life. 
Interest  in  such  problems  has  increased  since  the  September  11,  2001,  terrorist  attacks. 
Across  the  country,  water  infrastructure  systems  extend  over  vast  areas,  and  ownership 
and  operation  responsibility  are  both  public  and  private  but  are  overwhelmingly  non- 
federal.  Since  the  attacks,  federal  dam  operators  and  water  and  wastewater  utilities  have 
been  under  heightened  security  conditions  and  are  evaluating  security  plans  and 
measures.  Policymakers  are  considering  a  number  of  options,  including  enhanced 
physical  security,  better  communication  and  coordination,  and  research.  A  key  issue  is 
how  additional  protections  and  resources  directed  at  public  and  private  sector  priorities 
will  be  funded.  In  response.  Congress  has  approved  $410  million  in  funds  for  security 
at  water  infrastructure  facilities  (P.L.  107-117,  P.L.  108-7,  and  P.L.  108-11)  and  passed 
a  bill  requiring  drinking  water  utilities  to  conduct  security  vulnerability  assessments 
(P.L.  107-188).  Congress  also  created  a  Department  of  Homeland  Security  with 
responsibilities  to  coordinate  information  to  secure  the  nation’s  critical  infrastructure, 
including  the  water  sector  (P.L.  107-297).  Continuing  attention  to  these  issues  in  the 
108*  Congress  is  anticipated.  Current  interest  is  focusing  on  bills  concerning  security 
of  wastewater  utilities  (H.R.  866,  S.  1039).  This  report  will  be  updated  as  warranted. 


The  September  1 1,  2001,  attacks  on  the  World  Trade  Center  and  the  Pentagon  have 
drawn  attention  to  the  security  of  many  institutions,  facilities,  and  systems  in  the  United 
States,  including  the  nation’s  water  supply  and  water  quality  infrastructure.'  These 
systems  have  long  been  recognized  as  being  potentially  vulnerable  to  terrorist  attacks  of 
various  types,  including  physical  disruption,  bioterrorism/chemical  contamination,  and 
cyber  attack.  Damage  or  destruction  by  terrorist  attack  could  disrupt  the  delivery  of  vital 
human  services  in  this  country,  threatening  public  health  and  the  environment,  or  possibly 


*  For  additional  information,  see  the  CRS  Electronic  Briefing  Book  on  Terrorism 
[http://www.congress.gov/brbk/html/ebter  1  .html] . 
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causing  loss  of  life.  The  potential  for  terrorism  is  not  new.  In  1941,  Federal  Bureau  of 
Investigation  Director  J.  Edgar  Hoover  wrote,  “It  has  long  been  recognized  that  among 
public  utilities,  water  supply  facilities  offer  a  particularly  vulnerable  point  of  attack  to  the 
foreign  agent,  due  to  the  strategic  position  they  occupy  in  keeping  the  wheels  of  industry 
turning  and  in  preserving  the  health  and  morale  of  the  American  populace.”  Water 
infrastructure  systems  also  are  highly  linked  with  other  infrastructures,  especially  electric 
power  and  transportation,  as  well  as  the  chemical  industry  which  supplies  treatment 
chemicals,  making  security  of  all  of  them  an  issue  of  concern. 

Background 

Broadly  speaking,  water  infrastructure  systems  include  surface  and  ground  water 
sources  of  untreated  water  for  municipal,  industrial,  agricultural,  and  household  needs; 
dams,  reservoirs,  aqueducts,  and  pipes  that  contain  and  transport  raw  water;  treatment 
facilities  that  remove  raw  water  contaminants;  finished  water  reservoirs;  systems  that 
distribute  water  to  users;  and  wastewater  collection  and  treatment  facilities.  Across  the 
country,  these  systems  comprise  more  than  75,000  dams  and  reservoirs;  thousands  of 
miles  of  pipes,  aqueducts,  water  distribution,  and  sewer  lines;  168,000  public  drinking 
water  facilities  (many  serving  as  few  as  25  customers);  and  about  16,000  publicly  owned 
wastewater  treatment  facilities.  Ownership  and  management  are  both  public  and  private; 
the  federal  government  has  ownership  responsibility  for  hundreds  of  dams  and  diversion 
structures,  but  the  vast  majority  of  the  nation’s  water  infrastructure  is  either  privately 
owned  or  owned  by  non-federal  units  of  government. 

The  federal  government  has  built  hundreds  of  water  projects,  primarily  dams  and 
reservoirs  for  irrigation  development  and  flood  control,  with  municipal  and  industrial 
water  use  (M&I)  as  an  incidental,  self-financed,  project  purpose.  Many  of  these  facilities 
are  critically  entwined  with  the  nation’s  overall  water  supply,  transportation,  and 
electricity  infrastructure.  The  largest  federal  facilities  were  built  and  are  managed  by  the 
Bureau  of  Reclamation  (Bureau)  of  the  Department  of  the  Interior  and  the  U.S.  Army 
Corps  of  Engineers  (Corps)  of  the  Department  of  Defense. 

Bureau  reservoirs,  particularly  those  along  the  Colorado  River,  supply  water  to 
millions  of  people  in  southern  California,  Arizona,  and  Nevada  via  Bureau  and  non- 
Bureau  aqueducts.  Bureau  projects  also  supply  water  to  9  million  acres  of  farmland  and 
other  municipal  and  industrial  water  users  in  the  17  western  states.  The  Corps  supplies 
water  to  thousands  of  cities,  towns,  and  industries  from  the  9.5  million  acre-feet  of  water 
stored  in  its  116  lakes  and  reservoirs  throughout  the  country,  including  service  to 
approximately  one  million  residents  of  the  District  of  Columbia,  Arlington  County,  and 
the  City  of  Ealls  Church.  The  largest  federal  facilities  also  produce  enormous  amounts 
of  power.  Eor  example.  Hoover  and  Glen  Canyon  dams  on  the  Colorado  River  represent 
23%  of  the  installed  electrical  capacity  of  the  Bureau  of  Reclamation’s  58  power  plants 
in  the  West  and  7%  of  the  total  installed  capacity  in  the  Western  United  States.  Similarly, 
Corps  facilities  and  the  Bureau’ s  Grand  Coulee  Dam  on  the  Columbia  River  provide  43% 
of  the  total  installed  capacity  in  the  West  (25%  nationwide). 

A  fairly  small  number  of  large  drinking  water  and  wastewater  utilities  located 
primarily  in  urban  areas(about  15%  of  the  systems)  provide  water  services  to  more  than 
75%  of  the  U.S.  population.  Arguably,  these  systems  represent  the  greatest  targets  of 
opportunity  for  terrorist  attacks,  while  the  large  number  of  small  systems  that  each  serve 
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fewer  than  10,000  persons  are  less  likely  to  be  perceived  as  key  targets  by  terrorists  who 
might  seek  to  disrupt  water  infrastructure  systems.  However,  the  more  numerous  smaller 
systems  also  tend  to  be  less  protected  and,  thus,  are  potentially  more  vulnerable  to  attack, 
whether  by  vandals  or  terrorists.  A  successful  attack  could  cause  widespread  panic, 
economic  impacts,  and  a  loss  of  public  confidence  in  water  supply  systems. 

Threats  resulting  in  physical  destruction  to  any  of  these  systems  could  include 
disruption  of  operating  or  distribution  system  components,  power  or  telecommunications 
systems,  electronic  control  systems,  and  actual  damage  to  reservoirs  and  pumping 
stations.  A  loss  of  flow  and  pressure  would  cause  problems  for  customers  and  would 
hinder  firefighting  efforts.  Further,  destruction  of  a  large  dam  could  result  in  catastrophic 
flooding  and  loss  of  life.  Bioterrorism  or  chemical  threats  could  deliver  massive 
contamination  by  small  amounts  of  microbiological  agents  or  toxic  chemicals,  and  could 
endanger  the  public  health  of  thousands.  While  some  experts  believe  that  risks  to  water 
systems  actually  are  small,  because  it  would  be  difficult  to  introduce  sufficient  quantities 
of  agents  to  cause  widespread  harm,  concern  and  heightened  awareness  of  potential 
problems  are  apparent.  Characteristics  that  are  relevant  to  a  biological  agent’s  potential 
as  a  weapon  include  its  stability  in  a  drinking  water  system,  virulence,  culturability  in  the 
quantity  required,  and  resistance  to  detection  and  treatment.  Cyber  attacks  on  computer 
operations  can  affect  an  entire  infrastructure  network,  and  hacking  in  water  utility  systems 
could  result  in  theft  or  corruption  of  information  or  denial  and  disruption  of  service. 

Responses  to  Security  Concerns 

Federal  dam  operators  went  on  “high-alert”  immediately  following  the  September 
1 1  terrorist  attacks.  The  Bureau  closed  its  visitor  facilities  at  Grand  Coulee,  Hoover,  and 
Glen  Canyon  dams.^  Because  of  potential  loss  of  life  and  property  downstream  if 
breached,  security  threats  are  under  constant  review,  and  coordination  efforts  with  both 
the  National  Guard  and  local  law  enforcement  officials  are  ongoing.  The  Corps  also 
operates  under  continued  high  defense  alert  and  temporarily  closed  all  its  facilities  to 
visitors  after  September  11,  although  locks  and  dams  remained  operational. 

Although  officials  believe  that  risks  to  water  and  wastewater  utilities  are  small, 
operators  have  been  under  heightened  security  conditions  since  September  1 1 .  Local 
utilities  have  primary  responsibility  to  assess  their  vulnerabilities  and  prioritize  them  for 
necessary  security  improvements.  Most  (especially  in  urban  areas)  have  emergency 
preparedness  plans  that  address  issues  such  as  redundancy  of  operations,  public 
notification,  and  coordination  with  law  enforcement  and  emergency  response  officials. 
However,  many  plans  were  developed  to  respond  to  natural  disasters,  domestic  threats 
such  as  vandalism,  and,  in  some  cases,  cyber  attacks.  Drinking  water  and  wastewater 
utilities  coordinated  efforts  to  prepare  for  possible  Y2K  impacts  on  their  computer 
systems,  but  these  efforts  focused  more  on  cyber  security  than  physical  terrorism 
concerns.  Thus,  it  is  unclear  whether  previously  existing  plans  incorporate  sufficient 
procedures  to  address  other  types  of  terrorist  threats.  Utility  officials  are  reluctant  to 
disclose  details  of  their  systems  or  these  confidential  plans,  since  doing  so  might  alert 
terrorists  to  vulnerabilities. 


^  Together,  these  three  facilities  make  up  roughly  70%  of  the  total  installed  electrical  capacity 
(14,092  megawatts)  at  Bureau  projects  throughout  the  West  (28%  of  hydropower  capacity  in  the 
West  and  16%  nationwide). 
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Water  supply  was  one  of  eight  eritieal  infrastrueture  systems  identified  in  President 
Clinton’s  1998  Presidential  Deeision  Direetive  63  (PDD-63)^  as  part  of  a  eoordinated 
national  effort  to  aehieve  the  eapability  to  proteet  the  nation’s  eritieal  infrastrueture  from 
intentional  aets  that  would  diminish  them.  These  efforts  foeused  primarily  on  the  340 
large  community  water  supply  systems  which  each  serve  more  than  100,000  persons.  The 
Environmental  Protection  Agency  (EPA)  was  identified  as  the  lead  federal  agency  for 
liaison  with  the  water  supply  sector.  In  response,  in  2000,  EPA  established  a  partnership 
with  the  American  Metropolitan  Water  Association  (AMWA)  and  American  Water 
Works  Association  (AWWA)  to  jointly  undertake  measures  to  safeguard  water  supplies 
from  terrorist  acts.  AWWA’s  Research  Eoundation  has  contracted  with  the  Department 
of  Energy’s  Sandia  National  Eaboratory  to  develop  a  vulnerability  assessment  tool  for 
water  systems  (as  an  extension  of  methodology  for  assessing  federal  dams).  EPA  is 
supporting  an  ongoing  project  with  the  Sandia  Eab  to  pilot  test  the  physical  vulnerability 
assessment  tool  and  develop  a  cyber  vulnerability  assessment  tool.  An  Information 
Sharing  and  Analysis  Center  (ISAC)  supported  by  an  EPA  grant  became  operational 
under  AMWA’s  leadership  in  December  2002.  It  will  allow  for  dissemination  of  alerts 
to  drinking  water  and  wastewater  utilities  about  threats  or  vulnerabilities  to  the  integrity 
of  their  operations  that  have  been  detected  and  viable  resolutions  to  problems. 

Some  research  on  water  sector  infrastructure  protection  is  underway.  The 
Department  of  the  Army  is  conducting  research  in  the  area  of  detection  and  treatment  to 
remove  various  chemical  agents.  EEMA  is  leading  an  effort  to  produce  databases  of 
water  distribution  systems  and  to  develop  assessment  tools  for  evaluating  threats  posed 
by  the  introduction  of  a  biological  or  chemical  agent  into  a  water  system.  The  Centers  for 
Disease  Control  is  developing  guidance  on  potential  biological  agents  and  the  effects  of 
standard  water  treatment  practices  on  their  persistence.  However,  in  the  January  2001 
report  of  the  President’s  Commission  on  Critical  Infrastructure  Protection,  ongoing  water 
sector  research  was  characterized  as  a  small  effort  that  leaves  a  number  of  gaps  and 
shortfalls  relative  to  U.S.  water  supplies,  including  development  of  threat/vulnerability 
risk  assessments  and  identification  of  biological  and  chemical  agents  of  concern."^ 

Eess  attention  has  been  focused  on  protecting  wastewater  treatment  facilities  than 
drinking  water  systems,  perhaps  because  destruction  of  them  probably  represents  more 
of  an  environmental  threat  (i.e.,  by  release  of  untreated  sewage)  than  direct  threat  to  life 
or  public  welfare.  Vulnerabilities  do  exist,  however.  Earge  underground  collector  sewers 
could  be  accessed  by  terrorist  groups  for  purposes  of  placing  destructive  devices  beneath 
buildings  or  city  streets.  Damage  to  a  wastewater  facility  prevents  water  from  being 
treated  and  can  impact  downriver  water  intakes.  Destruction  of  containers  that  hold  large 
amounts  of  chemicals  at  treatment  plants  could  result  in  release  of  toxic  chemical  agents, 
such  as  chlorine  gas .  To  prepare  for  potential  accidental  releases  of  hazardous  chemicals 
from  their  facilities,  3,460  wastewater  and  drinking  water  utilities  already  are  subject  to 
risk  management  planning  requirements  under  the  Clean  Air  Act.  Wastewater  and 
drinking  water  utility  organizations  are  implementing  computer  software  and  training 


^  “The  Clinton  Administration’s  Policy  on  Critical  Infrastructure  Protection:  Presidential 
Decision  Directive  63.”  See  [http://www.ciao.gov/resource/paper598.html]. 

Critical  Infrastructure  Assurance  Office.  Report  of  the  President  of  the  United  States  on  the 
Status  of  Federal  Critical  Infrastructure  Protection  Activities.  January  2001.  See 
[http://www.ciao.gov/resource/cip_2001_congrept.pdfl. 
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materials  to  evaluate  vulnerabilities  at  large,  medium,  and  small  utility  systems,  and  EPA 
has  provided  some  grant  assistance  for  vulnerability  assessments  (discussed  below). 

Federal  officials  have  been  reassessing  federal  infrastructure  vulnerabilities  for 
several  years.  The  Bureau  of  Reclamation’s  site  security  program  is  aimed  at  ensuring 
protection  of  the  Bureau’s  362  high-  and  significant-hazard  dams  and  facilities  and  58 
hydroelectric  plants.  The  Corps  implements  a  facility  protection  program  to  detect, 
protect,  and  respond  to  threats  to  Corps  facilities  and  a  dam  security  program  to 
coordinate  security  systems  for  Corps  infrastructure. 

A  February  2003  White  House  report  {The  National  Strategy  for  the  Physical 
Protection  of  Critical  Infrastructures  and  Key  Assets)  presents  a  strategy  for  protecting 
the  nation’s  critical  infrastructures  and  identifies  four  water  sector  initiatives:  identify 
high-priority  vulnerabilities  and  improve  site  security;  improve  monitoring  and  analytic 
capabilities;  improve  information  exchange  and  coordinate  contingency  planning;  and 
work  with  other  sectors  to  manage  unique  risks  resulting  from  interdependencies.  It  also 
proposes  establishing  an  IS  AC  for  information  sharing  among  dam  operators.  The 
strategy  is  intended  to  focus  national  protection  priorities,  inform  resource  allocation 
processes,  and  be  the  basis  for  cooperative  public  and  private  protection  actions. 

Department  of  Homeland  Security.  In  November,  Congress  approved  a  major 
government  reorganization  to  create  a  Department  of  Homeland  Security,  consolidating 
all  or  parts  of  22  federal  agencies  (P.F.  107-297).  The  new  department  includes 
coordination  to  secure  the  nation’s  critical  infrastructure,  including  water  infrastructure, 
through  partnerships  with  the  public  and  private  sectors.  It  is  responsible  for  detailed 
implementation  of  core  elements  of  the  national  strategy  for  protection  of  critical 
infrastructures.  One  of  its  tasks  is  to  assess  infrastructure  vulnerabilities,  an  activity  that 
wastewater  and  drinking  water  utilities  have  been  doing  since  September  11,  under  their 
own  initiatives  and  congressional  mandates  (P.F.  107-188,  discussed  below).  The 
legislation  did  not  transfer  Corps  or  Bureau  responsibilities  for  security  protection  of 
dams  or  EPA’s  responsibilities  to  assist  drinking  water  and  wastewater  utilities. 

Appropriations.  In  September  2001,  Congress  appropriated  $40  billion  for 
recovery  from  and  response  to  terrorist  attacks  (P.F.  107-38).  The  President  allocated  $20 
billion  of  this  total  (about  $30  million  went  to  water  infrastructure),  and  in  October  2001, 
he  requested  allocation  of  the  remaining  $20  billion  to  be  distributed  by  Congress.  The 
request  included  $245  million  for  federal  water  infrastructure  programs:  $30  million  for 
security  at  Bureau  facilities;  $139  million  for  security  at  Corps  facilities;  and  $45.5 
million  to  EPA  for  drinking  water  vulnerability  assessments.  P.F.  107-1 17,  the  DOD  and 
Emergency  Supplemental  Appropriations  Act  for  FY2002,  provided  the  full  amounts 
requested  for  the  Bureau  and  the  Corps  and  increased  funding  for  EPA,  including  $91 
million  to  strengthen  security  at  large  drinking  water  systems  through  vulnerability 
assessments  and  other  non- structural  security  efforts.  EPA  awarded  $51  million  for 
vulnerability  assessment  grants  to  449  utilities  in  2002,  averaging  $1 15,000  per  utility. 

The  President’s  FY2003  budget  requested  $115  million  for  security  at  water 
infrastructure  facilities,  consisting  of  $28.4  million  for  the  Bureau;  $65  million  for  the 
Corps;  and  $22  million  for  EPA,  including  $15  million  for  vulnerability  assessments  at 
small  and  medium-size  drinking  water  systems.  Final  action  on  appropriations  for  these 
agencies  was  delayed  until  February  2003.  In  P.F.  108-7,  Congress  appropriated  $85 
million  for  water  infrastructure  security  programs,  approving  the  amounts  requested  for 
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EPA  and  the  Bureau,  but  $30  million  less  than  was  requested  for  the  Corps’  facility 
security  program.  In  P.L.  108-11,  the  FY2003  supplemental  appropriations  bill  signed 
on  April  16  (H.R.  1559),  Congress  provided  an  additional  $39  million  for  the  Corps  and 
$25  million  for  the  Bureau,  for  increased  security  measures  at  their  facilities.  The 
President’s  FY2004  budget  request  seeks  $74  million  for  water  infrastructure  security, 
including  $32.4  million  for  EPA  to  support  utility  vulnerability  assessments  and  the  Water 
IS  AC,  $13  million  for  the  Corps,  and  $28.6  million  for  the  Bureau. 

Policy  Options  and  Congressional  Responses 

Congress  and  other  policymakers  are  considering  a  number  of  options  in  this  area, 
including  enhanced  physical  security,  communication  and  coordination,  and  research. 
Regarding  physical  security,  a  key  question  is  whether  protective  measures  should  be 
focused  on  the  largest  water  systems  and  facilities,  where  risks  to  the  public  are  greatest, 
or  on  all,  since  small  facilities  may  be  more  vulnerable.  Another  option  is  review  of 
existing  preparedness  plans  to  ensure  that  they  address  newer  security  concerns. 

Policymakers  also  are  examining  measures  that  could  improve  coordination  and 
exchange  of  information  on  vulnerabilities,  risks,  threats,  and  responses.  This  is  a  key 
objective  of  the  Water  IS  AC  and  also  of  the  new  Department  of  Homeland  Security, 
which  includes,  for  example,  functions  of  the  National  Infrastructure  Protection  Center 
(NIPC)  of  the  FBI  that  brings  together  the  private  sector  and  government  agencies  at  all 
levels  to  protect  critical  infrastructure,  especially  on  cyber  issues.  One  issue  of  interest 
is  how  the  new  Department  will  coordinate  its  activities  with  ongoing  security  efforts  by 
other  federal  agencies  and  non-federal  entities  that  operate  water  infrastructure  systems. 

Among  the  research  needs  being  addressed  are  tools  for  vulnerability  and  risk 
analysis,  identification  and  response  to  biological/chemical  agents,  real-time  monitoring 
of  water  supplies,  and  development  of  information  technology.  The  cost  of  additional 
protections  and  how  to  pay  for  them  are  issues  of  interest,  and  policymakers  continue  to 
consider  resource  needs  and  how  to  direct  them  at  public  and  private  sector  priorities. 

The  107*  and  108*  Congresses  have  considered  legislation  to  address  various  policy 
options,  including  government  reorganization,  and  additional  appropriations  (discussed 
above).  In  May  2002,  Congress  approved  the  Bioterrorism  Preparedness  Act  (P.F.  107- 
288)  requiring  drinking  water  systems  serving  more  than  3,300  persons  to  conduct 
vulnerability  analyses  and  authorizing  grant  funding  to  assist  utilities.  (For  information, 
see  CRS  Report  RF31294,  Safeguarding  the  Nation’s  Drinking  Water:  EPA  and 
Congressional  Actions.)  In  2001,  the  House  and  Senate  considered  but  did  not  enact 
legislation  authorizing  a  6-year  grant  program  for  research  and  development  on  security 
of  water  supply  and  wastewater  treatment  systems  (H.R.  3178,  S.  1593).  In  October 
2002,  the  House  approved  a  bill  authorizing  $220  million  in  grants  and  other  assistance 
for  vulnerability  assessments  by  wastewater  treatment  utilities  (H.R.  5 1 69),  but  the  Senate 
did  not  act  on  a  related  bill  (S.  3037).  Fegislation  authorizing  the  Bureau  to  contract  with 
local  law  enforcement  to  protect  its  facilities  was  enacted  (P.F.  107-69).  In  the  108* 
Congress,  legislation  authorizing  vulnerability  assessment  grants  to  wastewater  utilities 
(H.R.  866,  identical  to  H.R.  5169  in  the  107*  Congress)  was  approved  by  the  House  on 
May  7,  by  a  413-7  vote.  The  Senate  Environment  and  Public  Works  Committee  approved 
related  legislation  on  May  15  (S.  1039). 


